CVE-2026-98044
Received Received - Intake

BPF Legacy Packet Load Rejection in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98044
EUVD
EUVD-2026-86697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. It occurs when legacy packet load instructions (BPF_LD_ABS or BPF_LD_IND) are used in callback functions. The verifier incorrectly models these loads as implicit returns, leading to a situation where the callback return contract is violated. This triggers a verifier bug, causing a warning and an -EFAULT error during BPF program loading. The issue arises because these legacy instructions are deprecated and should be rejected when used in callbacks to avoid complicating the verifier's implicit return model.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF verifier warnings or errors related to legacy packet loads. Use commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf to search for relevant messages. Ensure your kernel version is updated to a patched release.

Impact Analysis

If exploited, this vulnerability allows a privileged program loader to cause a verifier warning and an -EFAULT error during BPF program loading. This could disrupt the loading of legitimate BPF programs, potentially leading to denial-of-service conditions or unexpected behavior in the kernel. Since BPF is used for network filtering and other low-level operations, this could impact system stability and security.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this CVE. Avoid loading BPF programs with legacy packet loads (BPF_LD_ABS or BPF_LD_IND) from privileged contexts. Monitor kernel logs for BPF-related errors post-update to confirm resolution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart